System and Method for Protecting Against Data Storage Attacks

2. The electronic device of claim 1, wherein the mitigation of the storage attack by the processor circuitry additionally includes stopping the identified malicious process, such that the identified malicious process is prevented from further modifying the memory blocks.

3. The electronic device of claim 1, wherein the processor circuitry designates the canary blocks by at least one of marking the canary blocks as bad blocks or by occupying the canary blocks, such that the operating system does not use the canary blocks for storing the electronic files.

4. The electronic device of claim 1, wherein the canary blocks include one or more memory blocks located at a beginning of the memory, such that detection time of the storage attack is improved when the storage attack begins modifying memory blocks at the beginning of the memory.

5. The electronic device of claim 4, wherein the beginning of the memory comprises the memory blocks located within an initial ten percent of the memory.

6. The electronic device of claim 1, wherein at least one of the canary blocks are randomly chosen or the canary block are chosen based on the memory blocks most likely to be affected by malicious processes.

8. The electronic device of claim 1, wherein the monitoring of the canary blocks by the processor circuitry to identify the modified canary block includes receiving a notification from a driver when one of the canary blocks has been modified.

10. The method of claim 9, wherein the mitigation of the storage attack by the processor circuitry additionally includes stopping the identified malicious process by the processor circuitry, such that the identified malicious process is prevented from further modifying the memory blocks.

11. The method of claim 9, wherein the processor circuitry designates the canary blocks by at least one of marking the canary blocks as bad blocks or by occupying the canary blocks, such that the operating system does not use the canary blocks for storing the electronic files.

12. The method of claim 9, wherein the canary blocks include one or more memory blocks located at a beginning of the memory, such that detection time of the storage attack is improved when the storage attack begins modifying memory blocks at the beginning of the memory.

13. The method of claim 12, wherein the beginning of the memory comprises the memory blocks located within an initial ten percent of the memory.

14. The method of claim 9, wherein at least one of the canary blocks are randomly chosen or the canary block are chosen based on the memory blocks most likely to be affected by malicious processes.

16. The method of claim 9, wherein the monitoring of the canary blocks by the processor circuitry to identify the modified canary block includes receiving a notification from a driver when one of the canary blocks has been modified.

18. The memory of claim 17, wherein the mitigation of the storage attack by the processor circuitry additionally includes stopping the identified malicious process by the processor circuitry, such that the identified malicious process is prevented from further modifying the memory blocks.

20. The memory of claim 17, wherein the monitoring of the canary blocks to identify the modified canary block includes receiving a notification from a driver when one of the canary blocks has been modified.